Overall, per user, per patient.

What regulatory jurisdiction are you under? US, EU, UK, etc., all have sharply differing concerns.

You'll need a legal advisor to determine what information can and cannot be exchanged. Note that "no patient IDs" doesn't mean that cases aren't identifiable. Diagnosis and timing information are themselves sufficient in many instances, any additional information (the classic ASL --- age, sex, and location --- would also strongly reduce search space). You're working against 33 bits:

https://33bits.wordpress.com/about/